CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,798 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
152,470 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2013-3537 EXP | Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_po… | Patch early | 7.5 high | 2.2% | 2013-05-13 |
| CVE-2013-3721 EXP | SQL injection vulnerability in awards.php in PsychoStats 3.2.2b allows remote attackers to execute arbitrary SQL commands via the d parameter. | Patch early | 7.5 high | 2.2% | 2013-05-31 |
| CVE-2013-5311 EXP | Multiple SQL injection vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to execute arbitrary SQL commands via the "n" parameter to… | Patch early | 7.5 high | 2.2% | 2013-08-19 |
| CVE-2006-6739 EXP | PHP remote file inclusion vulnerability in buycd.php in Paristemi 0.8.3 allows remote attackers to execute arbitrary PHP code via a URL in the HTTP_DO… | Patch early | 7.5 high | 2.2% | 2006-12-26 |
| CVE-2006-5312 EXP | PHP remote file inclusion vulnerability in shoutbox.php in the Ajax Shoutbox 0.0.5 and earlier module for phpBB allows remote attackers to execute arb… | Patch early | 7.5 high | 2.2% | 2006-10-17 |
| CVE-2006-6550 EXP | PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in… | Patch early | 7.5 high | 2.2% | 2006-12-14 |
| CVE-2006-6551 EXP | PHP remote file inclusion vulnerability in libs/tucows/api/cartridges/crt_TUCOWS_domains/lib/domainutils.inc.php in Tucows Client Code Suite (CCS) 1.2… | Patch early | 7.5 high | 2.2% | 2006-12-14 |
| CVE-2006-6575 EXP | PHP remote file inclusion vulnerability in ldap.php in Brian Drawert Yet Another PHP LDAP Admin Project (yaplap) 0.6 and 0.6.1 allows remote attackers… | Patch early | 7.5 high | 2.2% | 2006-12-15 |
| CVE-2006-6590 EXP | PHP remote file inclusion vulnerability in usercp_menu.php in AR Memberscript allows remote attackers to execute arbitrary PHP code via a URL in the s… | Patch early | 7.5 high | 2.2% | 2006-12-15 |
| CVE-2017-12970 EXP | Cross-site request forgery (CSRF) vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack the authentication of authenticated users for… | Patch early | 8.8 high | 2.2% | 2017-08-23 |
| CVE-2017-16513 EXP | Ipswitch WS_FTP Professional before 12.6.0.3 has buffer overflows in the local search field and the backup locations field, aka WSCLT-1729. | Patch early | 7.8 high | 2.2% | 2017-11-03 |
| CVE-2009-5102 EXP | SQL injection vulnerability in default.asp in ATCOM Netvolution 1.0 ASP allows remote attackers to execute arbitrary SQL commands via the bpe_nid para… | Patch early | 7.5 high | 2.2% | 2011-10-21 |
| CVE-2008-6119 EXP | Static code injection vulnerability in gooplecms/admin/account/action/editpass.php in Goople CMS 1.7 allows remote attackers to inject arbitrary PHP c… | Patch early | 7.5 high | 2.2% | 2009-02-11 |
| CVE-2006-3962 EXP | PHP remote file inclusion vulnerability in administrator/components/com_bayesiannaivefilter/lang.php in the bayesiannaivefilter component (com_bayesia… | Patch early | 7.5 high | 2.2% | 2006-08-01 |
| CVE-2017-16570 EXP | KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_0… | Patch early | 8.8 high | 2.2% | 2017-11-06 |
| CVE-2003-1086 EXP | PHP remote file inclusion vulnerability in pm/lib.inc.php in pMachine Free and pMachine Pro 2.2 and 2.2.1 allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 2.2% | 2003-06-17 |
| CVE-2008-0233 EXP | Unrestricted file upload vulnerability in Zero CMS 1.0 Alpha and earlier allows remote attackers to bypass intended access restrictions and upload and… | Patch early | 7.5 high | 2.2% | 2008-01-11 |
| CVE-2008-1971 EXP | phShoutBox Final 1.5 and earlier only checks passwords when specified in $_POST, which allows remote attackers to gain privileges by setting the (1) p… | Patch early | 7.5 high | 2.2% | 2008-04-27 |
| CVE-2013-5318 EXP | SQL injection vulnerability in Ginkgo CMS 5.0 allows remote attackers to execute arbitrary SQL commands via the rang parameter to index.php. | Patch early | 7.5 high | 2.2% | 2013-08-20 |
| CVE-2019-18194 EXP | TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junction to restore a malicious DLL f… | Patch early | 7.8 high | 2.2% | 2020-01-10 |
| CVE-2012-2338 EXP | SQL injection vulnerability in includes/picture.class.php in Galette 0.63, 0.63.1, 0.63.2, 0.63.3, and 0.64rc1 allows remote attackers to execute arbi… | Patch early | 7.5 high | 2.2% | 2012-05-21 |
| CVE-2007-1703 EXP | SQL injection vulnerability in index.php in the RWCards (com_rwcards) 2.4.3 and earlier component for Joomla! allows remote attackers to execute arbit… | Patch early | 7.5 high | 2.2% | 2007-03-27 |
| CVE-2007-1817 EXP | SQL injection vulnerability in index.php in the Lykos Reviews (lykos_reviews) 1.00 module for Xoops allows remote attackers to execute arbitrary SQL c… | Patch early | 7.5 high | 2.2% | 2007-04-02 |
| CVE-2007-2773 EXP | SQL injection vulnerability in plugins/mp3playlist/mp3playlist.php in Zomplog 3.8 and earlier allows remote attackers to execute arbitrary SQL command… | Patch early | 7.5 high | 2.2% | 2007-05-21 |
| CVE-2008-6718 EXP | U&M Software JustBookIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to h… | Patch early | 7.5 high | 2.2% | 2009-04-13 |
| CVE-2007-1806 EXP | SQL injection vulnerability in categos.php in the RM+Soft Gallery (rmgallery) 1.0 module for Xoops allows remote attackers to execute arbitrary SQL co… | Patch early | 7.5 high | 2.2% | 2007-04-02 |
| CVE-2007-2183 EXP | SQL injection vulnerability in index.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9 allows remote attackers to execute arbitrary SQL comma… | Patch early | 7.5 high | 2.2% | 2007-04-24 |
| CVE-2007-4502 EXP | SQL injection vulnerability in index.php in the BibTeX component (com_jombib) 1.3 and earlier for Joomla! allows remote attackers to execute arbitrary… | Patch early | 7.5 high | 2.2% | 2007-08-23 |
| CVE-2007-4509 EXP | SQL injection vulnerability in index.php in the EventList component (com_eventlist) 0.8 and earlier for Joomla! allows remote attackers to execute arb… | Patch early | 7.5 high | 2.2% | 2007-08-23 |
| CVE-2009-3949 EXP | cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication for the donewauthor action, which allows remo… | Patch early | 7.5 high | 2.2% | 2009-11-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt